Introduce mime type file blocking

2 files changed, 13 insertions, 0 deletions

diff --git a/php/includes/settings.inc.php b/php/includes/settings.inc.php
index 872fde0..01a0f86 100644
--- a/php/includes/settings.inc.php
+++ b/php/includes/settings.inc.php
@@ -81,6 +81,13 @@ define('POMF_FILES_LENGTH', 6);
  */
 define('POMF_URL', 'https://i.pantsu.cat/');
 
+
+/* *
+ * Blocked mime types
+ * @param string[] $FILTER_MIME blocked mime types
+ */
+$FILTER_MIME = array("")
+
 /**
  * Double dot file extensions
  *
diff --git a/php/upload.php b/php/upload.php
index 476120b..a189f87 100644
--- a/php/upload.php
+++ b/php/upload.php
@@ -80,6 +80,12 @@ function uploadFile($file)
         throw new UploadException($file->error);
     }
 
+    // Check if mime type is blocked
+    if (!in_array(mime_content_type($file), $FILTER_MIME)) {
+        throw new UploadException(UPLOAD_ERR_EXTENSION);
+    }
+
+
     // Check if a file with the same hash and size (a file which is the same)
     // does already exist in the database; if it does, return the proper link
     // and data. PHP deletes the temporary file just uploaded automatically.